The vulnerability CVE-2026-25447 in Jonathan Daggerhart's Widget Wrangler plugin is due to improper control over code generation, enabling code injection attacks. It affects all versions up to 2.3.9. The CVSS 3.1 base score is 9.1, with attack vector network, low attack complexity, requiring high privileges but no user interaction, and impacts confidentiality, integrity, and availability. No official patch or fix information is available at this time.

Successful exploitation allows an attacker with high privileges to inject and execute arbitrary code remotely, resulting in complete compromise of the affected system's confidentiality, integrity, and availability. This can lead to unauthorized data access, modification, or destruction, and potential disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected software to trusted users with high privileges only and monitor for suspicious activity related to Widget Wrangler. Avoid deploying this plugin in sensitive environments until a patch is released.